I85PREP
⌘ K
CWSR study materials
CWSR study resources

CWSR practice questions

One question at a time. Build your CWSR understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1WLAN Security Fundamentals and Risk Assessment

In a WLAN risk assessment, which security control provides the strongest protection for management-frame traffic on a modern enterprise network?

  1. MAC address filtering at the AP
  2. SSID broadcast suppression
  3. Management Frame Protection (802.11w) Correct answer.
  4. WEP with a shared 128-bit key

Explanation

802.11w adds integrity protection and, for certain robust management frames, encryption so that spoofed deauthentication and disassociation frames cannot be forged by an attacker. Without it, unauthenticated management frames are trivially spoofable, enabling denial-of-service and handshake-capture attacks. MAC filtering and SSID hiding are obscurity measures that do not protect frame integrity.

Question 2WLAN Security Fundamentals and Risk Assessment

Which weakness of WEP makes it unsuitable for protecting WLAN traffic even when a long key is configured?

  1. It requires a public key infrastructure with per-client certificates
  2. The RC4 keystream is reused because the 24-bit IV space repeats quickly Correct answer.
  3. It depends on an external RADIUS server for encryption keys
  4. It uses AES-CCMP with a weak key derivation function

Explanation

WEP concatenates a 24-bit initialization vector with the shared key to seed RC4, and the small IV space causes keystream reuse that enables statistical key recovery. Attackers can collect enough frames to recover the key regardless of key length. WEP has no PKI, no AES-CCMP, and no RADIUS dependency.

Question 3WLAN Security Fundamentals and Risk Assessment

A security analyst wants to detect rogue access points on the corporate campus. Which approach most directly identifies an unauthorized AP connected to the wired network?

  1. Enabling WPA3-SAE on all managed APs
  2. Reviewing DHCP lease logs for unfamiliar hostnames
  3. Disabling SSID broadcast on managed APs
  4. Scanning the airspace and correlating discovered BSSIDs with the authorized AP inventory Correct answer.

Explanation

Wireless intrusion detection systems scan for beacon and probe response frames and compare observed BSSIDs and SSIDs against the known-good inventory, flagging unknown devices. This directly surfaces unauthorized radios. DHCP logs and SSID hiding do not reliably reveal rogue APs.

Question 4WLAN Security Fundamentals and Risk Assessment

Which statement best describes the role of the 4-way handshake in WPA2-Personal?

  1. It encrypts the SSID in beacon frames
  2. It derives fresh pairwise session keys from the PSK and nonces Correct answer.
  3. It authenticates the client against a RADIUS server
  4. It negotiates the channel and transmit power for the BSS

Explanation

In WPA2-Personal the pre-shared key is never sent over the air; instead the 4-way handshake combines the PSK with ANonce, SNonce, and MAC addresses to derive the pairwise transient key. This produces per-session keys and confirms both parties hold the PSK. RADIUS authentication applies to WPA2-Enterprise, not Personal.

Question 5WLAN Security Fundamentals and Risk Assessment

An attacker captures a WPA2-Personal 4-way handshake and attempts an offline dictionary attack. Which condition is necessary for that attack to succeed?

  1. The AP must be configured for 802.1X authentication
  2. The passphrase must be present in the attacker's wordlist Correct answer.
  3. The client must be using WPA3 transition mode
  4. The AP must have SSID broadcast enabled

Explanation

The captured handshake yields material to test candidate passphrases offline, and success requires the actual passphrase to appear in the tested dictionary. SSID broadcast and transition mode do not determine whether the passphrase is guessable. 802.1X would mean Enterprise mode, where a PSK dictionary attack does not apply.

Question 6WLAN Security Fundamentals and Risk Assessment

Which risk is most directly mitigated by deploying WPA3-SAE instead of WPA2-Personal?

  1. Unauthorized APs plugged into the wired network
  2. Offline dictionary attacks against captured handshakes Correct answer.
  3. Management-frame deauthentication floods
  4. Rogue DHCP servers on the wireless segment

Explanation

SAE performs a simultaneous authentication of equals exchange that is resistant to offline guessing, so a captured exchange cannot be attacked with a dictionary without interacting with the network. Management-frame floods are addressed by 802.11w, and rogue AP and DHCP risks require other controls.

Question 7WLAN Security Fundamentals and Risk Assessment

A guest wireless network is isolated from the corporate network but shares the same physical APs. Which design element most reduces the risk of guest-to-corporate lateral movement?

  1. Using a separate VLAN and firewall policy for guest traffic Correct answer.
  2. Publishing the guest SSID in beacons
  3. Using the same PSK for guest and corporate SSIDs
  4. Enabling WEP on the guest SSID for compatibility

Explanation

Segmenting guest traffic onto its own VLAN and enforcing firewall policy between guest and corporate zones prevents guests from reaching internal resources even though they share radios. Sharing a PSK or using WEP undermines that separation, and beacon advertisement is unrelated to lateral movement.

Question 8WLAN Security Fundamentals and Risk Assessment

In a WPA2-Enterprise deployment, which component issues the authentication decision that the AP enforces for a connecting supplicant?

  1. The RADIUS authentication server Correct answer.
  2. The supplicant's local credential cache
  3. The authenticator's ACL table
  4. The DHCP server on the client VLAN

Explanation

802.1X defines the supplicant, authenticator (the AP or controller), and authentication server; the RADIUS server validates credentials and returns accept or reject, which the authenticator enforces. The supplicant only supplies credentials, and DHCP assigns addressing after authentication.

Question 9WLAN Security Fundamentals and Risk Assessment

An organization wants to prevent wireless clients from being tricked into associating with an attacker's AP that advertises the corporate SSID. Which control most directly addresses this evil-twin risk?

  1. Disabling client roaming between APs
  2. Increasing the beacon interval on managed APs
  3. Requiring server certificate validation on clients during EAP authentication Correct answer.
  4. Using open authentication with a captive portal

Explanation

When clients validate the RADIUS server certificate during EAP (for example EAP-TLS or PEAP with validation), an evil twin that cannot present a trusted certificate fails authentication. Roaming and beacon settings do not authenticate the network. Open authentication with a portal provides no cryptographic assurance of the network's identity.

Question 10WLAN Security Fundamentals and Risk Assessment

Which threat is specifically enabled by the unprotected nature of 802.11 deauthentication frames in a network without 802.11w?

  1. Forced disconnection of clients to capture handshakes or disrupt service Correct answer.
  2. Recovery of the WPA2 PSK from beacon frames
  3. Injection of routes into the wired routing domain
  4. Decryption of AES-CCMP data frames

Explanation

Because deauthentication frames are unauthenticated without 802.11w, an attacker can spoof them to disconnect clients, which disrupts availability and forces reconnections that can be captured for offline attacks. Beacon frames do not carry the PSK, CCMP data is not decrypted by this technique, and wireless frames do not inject routing updates.

Question 11WLAN Security Fundamentals and Risk Assessment

A risk assessment finds that a warehouse uses WPA2-Personal with a passphrase shared among 400 handheld scanners and seasonal staff. What is the primary residual risk?

  1. WPA2-Personal cannot coexist with 802.11w
  2. The 4-way handshake cannot complete with more than one client per AP
  3. The PSK cannot be rotated without reconfiguring every device, and departure of any holder leaves the key exposed Correct answer.
  4. The APs will refuse to support more than 200 concurrent clients

Explanation

A shared PSK scales poorly because every device must be updated when the key changes, so organizations delay rotation and the key becomes widely known. Former staff or lost devices retain knowledge of the key. Client-count and handshake limits are not inherent to WPA2-Personal, and 802.11w can be used alongside it.

Question 12WLAN Security Fundamentals and Risk Assessment

Which factor most increases the likelihood of a successful brute-force attack against a WPA2-Personal passphrase?

  1. A passphrase drawn from a short, common-word list Correct answer.
  2. Enabling client isolation on the guest SSID
  3. A long SSID containing the company name
  4. Use of a 5 GHz-only radio configuration

Explanation

Offline attacks test candidate passphrases against a captured handshake, so a passphrase built from common words and short length falls quickly to dictionary and rule-based cracking. SSID naming, radio band, and client isolation do not affect passphrase entropy.

Question 13WLAN Security Fundamentals and Risk Assessment

A client device is configured to remember and automatically join any open network named "CorpWiFi." Which risk does this behavior create?

  1. The device will expose its WPA2 PSK to the open network
  2. The device will disable 802.11w automatically
  3. The device will refuse to use WPA3 networks
  4. The device may silently associate with an attacker's open AP using that name Correct answer.

Explanation

Preferred network lists that match on SSID alone allow an attacker to stand up an open AP with the same name and capture the client's traffic. The client has no way to verify the network's identity in an open association. This behavior does not disable WPA3 or 802.11w, and it does not reveal a separate WPA2 PSK.

Question 14WLAN Security Fundamentals and Risk Assessment

Which control best limits the impact of a lost corporate laptop that stored a WPA2-Enterprise profile with cached credentials?

  1. Revoking the user's certificate or account and enforcing certificate-based EAP Correct answer.
  2. Reducing the beacon interval
  3. Changing the SSID name
  4. Disabling SSID broadcast

Explanation

In WPA2-Enterprise with certificate-based EAP, revoking the user or device certificate at the PKI and disabling the account prevents the lost device from authenticating. SSID changes and beacon tuning are obscurity measures that do not stop a device holding valid credentials.

Question 15WLAN Security Fundamentals and Risk Assessment

Why is WPS push-button or PIN configuration considered a risk in a WLAN assessment?

  1. The PIN mechanism can be brute-forced to recover the network credentials Correct answer.
  2. It requires a RADIUS server on every AP
  3. It forces the use of WEP encryption
  4. It disables the 4-way handshake

Explanation

The WPS PIN exchange can be attacked with far fewer attempts than the full PIN space due to design flaws, allowing recovery of the WPA/WPA2 passphrase. WPS does not force WEP, disable the handshake, or require RADIUS. Disabling WPS is a standard hardening step.

Question 16WLAN Security Fundamentals and Risk Assessment

A penetration tester observes that a client sends probe requests containing the names of previously joined networks. What information exposure does this create?

  1. Disclosure of the client's preferred network history to a passive observer Correct answer.
  2. Disclosure of the AP's management IP address
  3. Disclosure of the RADIUS shared secret
  4. Disclosure of the WPA2 pairwise key

Explanation

Probe requests can include SSIDs from the client's preferred network list, revealing where the user has connected and enabling targeted evil-twin attacks. They do not carry encryption keys, RADIUS secrets, or AP management addresses. Enabling probe request randomization or directed probing limits this exposure.

Question 17WLAN Security Fundamentals and Risk Assessment

Which statement correctly distinguishes WPA2-Enterprise from WPA2-Personal in terms of risk exposure?

  1. Enterprise mode uses per-user credentials so a single compromised credential does not expose the shared key for all users Correct answer.
  2. Personal mode provides stronger resistance to offline attacks than Enterprise mode
  3. Personal mode requires a RADIUS server for key derivation
  4. Enterprise mode removes the need for encryption on the wireless link

Explanation

WPA2-Enterprise authenticates each user or device via 802.1X and derives unique session keys, so one compromised credential does not grant the network-wide key that a shared PSK would. Enterprise mode still encrypts traffic. Personal mode does not use RADIUS and is more exposed to offline PSK attacks.

Question 18WLAN Security Fundamentals and Risk Assessment

During a wireless risk assessment, an analyst finds several APs configured with default administrative credentials. Which risk does this present most directly?

  1. Reduced client roaming speed between APs
  2. Increased airtime consumption from beacon frames
  3. Unauthorized reconfiguration of SSIDs, security settings, and backdoor access Correct answer.
  4. Loss of WPA3-SAE support on client devices

Explanation

Default administrative credentials allow an attacker who reaches the management interface to change security settings, create rogue SSIDs, or establish persistent access. Airtime, roaming, and client WPA3 support are not consequences of default credentials. Hardening management access is a basic control.

Question 19WLAN Security Fundamentals and Risk Assessment

Which scenario best illustrates a misconfiguration that could expose internal corporate traffic to wireless eavesdropping?

  1. WPA3-SAE enabled on the corporate SSID
  2. A guest SSID mapped to the corporate VLAN without firewall restrictions Correct answer.
  3. A management SSID restricted to a dedicated VLAN
  4. 802.11w enforced on all managed APs

Explanation

Placing guest users on the corporate VLAN without policy enforcement lets unauthorized users reach internal resources and observe broadcast traffic. The other options are hardening measures that reduce exposure. VLAN-to-SSID mapping must align with the trust level of the users.

Question 20WLAN Security Fundamentals and Risk Assessment

Which protocol provides port-based network access control that underpins WPA2-Enterprise authentication?

  1. 802.11r
  2. 802.11w
  3. 802.11k
  4. 802.1X Correct answer.

Explanation

802.1X defines port-based access control using EAP between supplicant, authenticator, and authentication server, which is the framework for WPA2-Enterprise. 802.11w covers management-frame protection, while 802.11k and 802.11r support radio resource measurement and fast roaming respectively.

Question 21WLAN Security Fundamentals and Risk Assessment

An attacker uses a directional antenna and high-gain amplifier to reach a corporate AP from a parking lot. Which assessment finding does this best illustrate?

  1. The AP is using an outdated firmware version
  2. The AP is vulnerable to WPS PIN brute force
  3. The AP is configured for WPA2-Enterprise
  4. The wireless coverage extends beyond the intended physical perimeter Correct answer.

Explanation

High-gain antennas extend the reachable distance of a network, so coverage that leaks outside the building increases exposure to off-site attackers. This is a site-survey and perimeter-control issue. WPS, firmware version, and enterprise mode are separate findings.

Question 22WLAN Security Fundamentals and Risk Assessment

Which combination correctly pairs a wireless threat with the control that most directly mitigates it?

  1. Evil twin AP - disabling SSID broadcast
  2. Deauthentication flood - enabling 802.11w Correct answer.
  3. Rogue AP on the wired network - increasing beacon interval
  4. WPS PIN brute force - using WPA3-SAE

Explanation

802.11w protects deauthentication and disassociation frames with integrity checks, preventing spoofed floods. SSID hiding does not stop an evil twin, WPA3-SAE does not address WPS PIN attacks on legacy devices, and beacon interval tuning does not detect wired rogue APs.

Question 23WLAN Security Fundamentals and Risk Assessment

A company plans a risk assessment for a new WLAN deployment. Which input is most important for estimating the likelihood of an over-the-air attack?

  1. The color of the AP housings
  2. The physical location of APs relative to public areas and the resulting RF footprint Correct answer.
  3. The brand of client devices used by employees
  4. The number of SSIDs configured on each AP

Explanation

Likelihood of over-the-air attack depends heavily on how far the RF signal reaches and whether it extends into public or uncontrolled areas. SSID count and device brand are minor factors, and housing color is irrelevant. A site survey quantifies the RF footprint.

Question 24WLAN Security Fundamentals and Risk Assessment

An assessment reveals that WPA2-Personal is used with a 12-character passphrase composed of random letters, numbers, and symbols. How should the analyst characterize the residual risk of an offline handshake attack?

  1. None, because WPA2-Personal cannot be attacked offline
  2. High, because 12-character passphrases are below the minimum for WPA2
  3. Moderate, because the handshake can be captured but cracking a high-entropy passphrase is computationally infeasible Correct answer.
  4. High, because any WPA2-Personal network is trivially cracked

Explanation

A captured handshake still permits offline guessing, but a long random passphrase has enough entropy that dictionary and brute-force attempts are impractical. The residual risk is therefore moderate rather than high or nonexistent. WPA2 has no 12-character minimum; the risk is driven by entropy, not a fixed length rule.

Question 25WLAN Security Fundamentals and Risk Assessment

Which finding in a WLAN risk assessment most strongly indicates a gap in the principle of least privilege for network access?

  1. Guest traffic is isolated on a separate VLAN with internet-only access
  2. Management frames are protected by 802.11w
  3. The corporate SSID uses WPA2-Enterprise with certificate-based EAP
  4. All employees, contractors, and guests authenticate to the same SSID and receive the same VLAN and ACLs Correct answer.

Explanation

Least privilege requires that access be scoped to role and need; a single SSID granting all populations identical network access violates that principle. The other options are controls that reduce exposure and enforce separation. Role-based SSIDs and VLANs with differentiated ACLs are the typical remediation.

Question 26WLAN Security Fundamentals and Risk Assessment

Which IEEE 802.11 management frame remains unprotected in an open or WEP-secured network, allowing an attacker to forcibly disconnect a client without possessing any key material?

  1. Deauthentication frame Correct answer.
  2. Probe response frame
  3. Beacon frame
  4. Association request frame

Explanation

Deauthentication and disassociation management frames are sent in the clear in open and WEP networks, so an attacker can spoof them to tear down a client's connection. Association, beacon, and probe response frames are also management frames, but the forced-disconnect effect is specifically achieved through deauthentication.

Question 27WLAN Security Fundamentals and Risk Assessment

A risk assessor is reviewing a WLAN that uses WPA2-Personal. Which characteristic of the four-way handshake most directly enables an offline dictionary attack against the pre-shared key?

  1. The GTK is encrypted with the PSK and can be recovered without capturing a handshake
  2. The ANonce and SNonce are exchanged in cleartext, allowing the attacker to derive the PTK from a captured handshake and test passphrase guesses offline Correct answer.
  3. The MIC in message 2 is computed over the passphrase itself rather than over the EAPOL frame
  4. The AP transmits the PMK in the first EAPOL message

Explanation

In WPA2-Personal the pairwise transient key is derived from the PSK, the two nonces, and the MAC addresses, all of which are visible or known from a captured four-way handshake. An attacker can therefore compute the PTK for each candidate passphrase and verify the MIC offline, without any further interaction with the AP.

Question 28WLAN Security Fundamentals and Risk Assessment

During a WLAN risk assessment, an analyst finds that the corporate SSID uses WPA2-Enterprise with PEAP and MS-CHAPv2 but the RADIUS server certificate is not validated by clients. Which risk does this configuration most directly create?

  1. An attacker can decrypt all unicast traffic by capturing the four-way handshake
  2. An attacker can force all clients to downgrade to WEP by sending forged beacon frames
  3. An attacker can bypass 802.1X by sending an EAPOL-Logoff frame to the authenticator
  4. An attacker can impersonate the RADIUS server with a rogue AP and capture the client's MS-CHAPv2 exchange for offline cracking Correct answer.

Explanation

Without server certificate validation, the supplicant cannot confirm that the EAP server is genuine. A rogue AP presenting any certificate can complete the PEAP tunnel and obtain the MS-CHAPv2 response, which is then subject to offline cracking.

Question 29WLAN Security Fundamentals and Risk Assessment

An organization deploys a WLAN controller that manages all access points from a single management VLAN. Which risk assessment finding is most significant when the controller's web interface is reachable from the corporate user VLAN with a shared local administrator account?

  1. Rogue AP detection will be disabled automatically when the management VLAN is shared
  2. An attacker who compromises any user workstation can reconfigure SSIDs, disable WIPS, or push malicious profiles to every managed AP Correct answer.
  3. Wireless clients will experience roaming delays because the controller is on a different VLAN
  4. The controller will be unable to enforce WPA3-SAE on client associations

Explanation

A controller centralizes configuration for all managed APs, so compromise of its administrative interface gives an attacker control over the entire wireless estate. Reachability from the user VLAN and a shared local account increase both the likelihood and the blast radius of such a compromise.

Question 30WLAN Security Fundamentals and Risk Assessment

Which security control most directly prevents an attacker from using a captured WPA2-Personal four-way handshake to recover the pre-shared key through offline guessing?

  1. Replacing the pre-shared key model with WPA2-Enterprise or WPA3-SAE Correct answer.
  2. Disabling SSID broadcast on the corporate WLAN
  3. Segmenting guest traffic onto a separate VLAN
  4. Enabling 802.11w management frame protection

Explanation

Offline guessing against a captured handshake is possible because WPA2-Personal derives the session key from a shared passphrase. WPA2-Enterprise uses per-user credentials and WPA3-SAE uses a password-authenticated key exchange that resists offline dictionary attacks, removing the exposure.

Question 31802.11 Security Architecture and Frame Protection

In an 802.11 WLAN using WPA2-Personal, which key hierarchy element is derived directly from the passphrase and the SSID during the 4-Way Handshake?

  1. The Pairwise Master Key (PMK) Correct answer.
  2. The Group Master Key (GMK)
  3. The Pairwise Transient Key (PTK)
  4. The Group Temporal Key (GTK)

Explanation

WPA2-Personal derives the PMK by running the passphrase and SSID through the PBKDF2 function with 4096 iterations and a 256-bit output. That PMK is never transmitted; it seeds the 4-Way Handshake that produces session keys.

Question 32802.11 Security Architecture and Frame Protection

Which protection does 802.11w (Management Frame Protection) add to the network?

  1. Confidentiality for beacon frames
  2. Encryption of all data frames with GCMP
  3. Authentication of probe requests using SAE
  4. Integrity protection for unicast and broadcast management frames Correct answer.

Explanation

802.11w protects management frames with a MIC so that deauthentication, disassociation, and action frames cannot be spoofed. Unicast management frames are also encrypted once the security association exists, while broadcast ones are integrity-protected only.

Question 33802.11 Security Architecture and Frame Protection

Which cipher suite did WPA (TKIP) use to provide per-packet key mixing and integrity?

  1. CCMP with AES
  2. GCMP with AES
  3. RC4 with Michael MIC Correct answer.
  4. BIP with AES-CMAC

Explanation

TKIP wraps RC4 with a per-packet key mixing function and adds the Michael message integrity code. It was designed as a firmware upgrade to WEP hardware and is now deprecated.

Question 34802.11 Security Architecture and Frame Protection

What is the primary purpose of the 4-Way Handshake in an RSN?

  1. To authenticate the RADIUS server to the supplicant
  2. To negotiate the channel width between the AP and the client
  3. To derive and confirm pairwise keys and install the group key Correct answer.
  4. To assign a VLAN identifier to the station

Explanation

The 4-Way Handshake confirms that both parties possess the PMK, derives fresh PTKs from nonces, and delivers the GTK to the station. It also installs keys so that protected data frames can flow.

Question 35802.11 Security Architecture and Frame Protection

Which entity generates the Group Master Key in an infrastructure BSS?

  1. The DHCP server
  2. The authentication server
  3. The supplicant
  4. The authenticator Correct answer.

Explanation

The authenticator, typically the AP, creates the GMK and uses it to derive the GTK that is distributed to associated stations. The GMK itself never leaves the authenticator.

Question 36802.11 Security Architecture and Frame Protection

Which EAP method derives keys from a password and is therefore vulnerable to offline dictionary attacks when captured in a WPA2-Enterprise handshake?

  1. EAP-PEAP-MSCHAPv2 Correct answer.
  2. PEAPv0 with server certificate only
  3. EAP-TLS
  4. EAP-TTLS with server certificate only

Explanation

MSCHAPv2 inside PEAP produces a challenge-response that an attacker can brute-force offline once the 4-Way Handshake is captured. Certificate-validated tunneled methods without a password-derived inner method avoid this exposure.

Question 37802.11 Security Architecture and Frame Protection

An administrator enables 802.11w with optional protection. Which management frame remains unprotected in that configuration?

  1. Unicast action frames after key installation
  2. Unicast deauthentication frames after key installation
  3. Broadcast deauthentication frames Correct answer.
  4. Unicast disassociation frames

Explanation

With optional PMF, broadcast and multicast robust management frames are not protected because no group integrity key is in place. Unicast robust management frames are protected once the pairwise security association is established.

Question 38802.11 Security Architecture and Frame Protection

A station associates to a WPA3-Personal network. Which authentication exchange replaces the PSK handshake used in WPA2-Personal?

  1. Tunneled Transport Layer Security
  2. Protected Extensible Authentication Protocol
  3. Simultaneous Authentication of Equals Correct answer.
  4. Extensible Authentication Protocol over LAN

Explanation

WPA3-Personal uses SAE, a Dragonfly-based password-authenticated key exchange that resists offline dictionary attacks. It replaces the PSK-based authentication of WPA2-Personal while still deriving a PMK for the 4-Way Handshake.

Question 39802.11 Security Architecture and Frame Protection

Which key is used to protect group-addressed robust management frames when PMF is required?

  1. The IGTK Correct answer.
  2. The PMK
  3. The MSK
  4. The PTK

Explanation

The Integrity Group Temporal Key protects broadcast and multicast robust management frames with the BIP cipher. It is distributed alongside the GTK during the handshake and group key update.

Question 40802.11 Security Architecture and Frame Protection

During the 4-Way Handshake, what does message 2 from the supplicant contain?

  1. The ANonce and the GTK encrypted under the KEK
  2. The SNonce and a MIC computed over the supplicant's values Correct answer.
  3. The MSK and the RSNE from the association request
  4. The PMK encrypted under the PTK

Explanation

Message 2 carries the supplicant nonce and a MIC that proves possession of the PMK, allowing the authenticator to derive the same PTK. It also echoes the RSNE so both sides confirm the negotiated cipher suite.

Question 41802.11 Security Architecture and Frame Protection

A network uses WPA2-Enterprise with EAP-TLS. Which key is exported by the EAP method and used to derive the PMK?

  1. The MSK Correct answer.
  2. The IGTK
  3. The GTK
  4. The GMK

Explanation

EAP methods export a Master Session Key to the authenticator, and the PMK is taken from the MSK. This ties the 802.1X authentication result to the subsequent 4-Way Handshake.

Question 42802.11 Security Architecture and Frame Protection

Why does CCMP use a 48-bit packet number that is never reused for a given key?

  1. To provide replay protection and uniqueness for the nonce Correct answer.
  2. To encode the station MAC address in the header
  3. To carry the VLAN tag across the distribution system
  4. To identify the cipher suite in the RSNE

Explanation

The packet number serves as the nonce component and lets the receiver reject frames whose sequence number is not greater than the last accepted one. Reuse would break both confidentiality and replay detection.

Question 43802.11 Security Architecture and Frame Protection

Which statement describes the role of the RSNE in the association exchange?

  1. It encrypts the association request frame.
  2. It carries the GTK from the AP to the station.
  3. It authenticates the station to the RADIUS server.
  4. It lists the cipher suites and authentication suite the station supports. Correct answer.

Explanation

The RSNE is an information element in beacon, probe, and association frames that advertises group and pairwise cipher suites, the AKM suite, and PMF capabilities. Both sides must agree on these parameters before keys are derived.

Question 44802.11 Security Architecture and Frame Protection

An attacker captures a WPA2-Personal 4-Way Handshake and attempts an offline dictionary attack. Which value must the attacker guess to validate a candidate passphrase?

  1. The GTK
  2. The IGTK
  3. The ANonce alone
  4. The PMK derived from the passphrase and SSID Correct answer.

Explanation

The attacker derives a candidate PMK from each guessed passphrase and SSID, then recomputes the PTK and checks the MIC in message 2. A match confirms the passphrase, which is why passphrase entropy matters.

Question 45802.11 Security Architecture and Frame Protection

Which protection mechanism prevents a forged deauthentication frame from disconnecting a WPA3 client that requires PMF?

  1. The sequence control field in the MAC header
  2. The MIC on robust management frames using the PTK or IGTK Correct answer.
  3. The WEP ICV appended to the frame
  4. The FCS computed by the radio hardware

Explanation

Under PMF, robust management frames carry a MIC computed with the pairwise key for unicast or the IGTK for broadcast. A forged frame lacks a valid MIC and is discarded by the receiving station.

Question 46802.11 Security Architecture and Frame Protection

Which statement best describes the difference between the PTK and the GTK?

  1. The PTK is shared by all stations in the BSS, while the GTK is unique per station.
  2. The PTK is derived from the GMK, while the GTK is derived from the PMK.
  3. The PTK is used only during the handshake, while the GTK protects all data frames.
  4. The PTK protects unicast traffic for one station, while the GTK protects group-addressed traffic for all stations. Correct answer.

Explanation

Each association produces a distinct PTK bound to the two MAC addresses and nonces, protecting unicast frames. The GTK is common to the BSS and protects broadcast and multicast frames.

Question 47802.11 Security Architecture and Frame Protection

A station receives a group key update message. Which cipher protects the integrity of the EAPOL-Key frame carrying the new GTK?

  1. Michael as the legacy integrity algorithm
  2. CRC-32 over the frame body
  3. HMAC-SHA1 with the PMK
  4. AES-CMAC as the key confirmation cipher Correct answer.

Explanation

EAPOL-Key frames in an RSN use AES-CMAC for the key MIC, and the GTK is wrapped with the key encryption key using AES key wrap. This ensures only holders of the KEK can install the new group key.

Question 48802.11 Security Architecture and Frame Protection

Which condition must be met for a WPA3-Personal network to resist offline guessing of the passphrase from a captured handshake?

  1. The SAE exchange must be used so no offline-verifiable material is exposed. Correct answer.
  2. The passphrase must be transmitted in the association request.
  3. The network must disable 802.11w.
  4. The network must use GCMP-256 exclusively.

Explanation

SAE performs a password-authenticated key exchange in which each guess requires an online interaction with the AP. An eavesdropper therefore cannot test candidate passphrases offline.

Question 49802.11 Security Architecture and Frame Protection

Which field in the CCMP header is set to zero on transmission to avoid leaking the priority of the frame?

  1. The packet number octets
  2. The reserved bits Correct answer.
  3. The Key ID bits
  4. The ExtIV bit

Explanation

The reserved bits in the CCMP header are transmitted as zero and ignored on reception. This avoids exposing traffic classification information that could aid an observer.

Question 50802.11 Security Architecture and Frame Protection

An attacker replays a previously captured, validly protected unicast data frame to a station using CCMP. What happens at the receiver?

  1. The frame is discarded because its packet number is not greater than the replay counter. Correct answer.
  2. The frame is forwarded to the distribution system after re-encryption.
  3. The frame is decrypted and delivered because the MIC verifies.
  4. The frame triggers a group key update.

Explanation

CCMP maintains a replay counter per key and traffic identifier, and any frame whose packet number does not exceed the counter is dropped. This blocks replay even when the MIC is valid.